Operations

VectorStore CRD

A VectorStore is the gateway’s upstream connection. It names the store kind, endpoint, credential Secret, and the inbound auth policy the gateway applies to client requests. An install may define more than one VectorStore; each Index.spec.backend.storeRef selects which store serves that upstream namespace.

apiVersion: hevlayer.com/v1alpha1
kind: VectorStore
metadata:
  name: turbopuffer-default
  namespace: layer
spec:
  kind: turbopuffer
  default: true
  endpoint:
    url: https://aws-us-east-1.turbopuffer.com
    region: aws-us-east-1
  turbopuffer:
    orgId: org_123
  credential:
    secretRef:
      name: layer
      key: turbopuffer-api-key
  inboundAuth:
    mode: deriveFromStore

Connection

Apply the VectorStore resource to the gateway’s Kubernetes namespace. The operator reads upstream credentials from the referenced Secret in that namespace.

Field	Purpose
`kind`	The backend engine: `turbopuffer`.
`default`	Selects the store for namespaces without an explicit store reference.
`endpoint.url`	Upstream API base URL.
`endpoint.region`	Operator-visible region label.
`turbopuffer.orgId`	Optional organization ID for dashboard links.
`credential.secretRef`	Kubernetes Secret containing the upstream credential.

Standalone gateway configuration

For the standalone gateway, see the OSS configuration guide.

Routing

The gateway builds one upstream client per VectorStore in the namespace. Requests whose namespace has an Index with spec.backend.storeRef use that store; other namespaces use the default store. Two Index objects cannot resolve to the same upstream namespace.

Inbound auth

spec.inboundAuth.mode controls the bearer token the gateway accepts.

Mode	Behavior
`deriveFromStore`	Accept the default store’s upstream credential as the inbound bearer.
`keys`	Accept independent key Secrets with `read`, `write`, and `admin` scopes.
`open`	No inbound authentication; use only for explicitly open environments.

For independent inbound keys:

spec:
  inboundAuth:
    mode: keys
    keys:
      - name: shop-rw
        scopes: [read, write]
        secretRef:
          name: layer
          key: layer-inbound-shop-rw-api-key

Kubernetes resolves each Secret in the resource’s namespace. Operator-managed workers and KEDA use the same Secret through LAYER_GATEWAY_API_KEY.

In every mode the gateway also accepts a minted ApiKey token whose vectorstore.<name> entitlement names this store, enforcing its scopes and namespace globs.

Status

The operator sets status.reachable and a Ready condition after validating the Secret references and probing GET /v1/namespaces on the store endpoint.